CVE-2026-47790
Privilege Escalation via QuFTP Log-based XSS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later
| CWE | CWE-79 |
| Vendor | qnap systems inc. |
| Product | quftp service |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for qnap systems inc. quftp service
Be the first to know when new unknown vulnerabilities affecting qnap systems inc. quftp service are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
QNAP Systems Inc. / QuFTP Service
1.4.x < 1.4.6 1.5.x < 1.5.5 1.6.x < 1.6.5
References
Credits
Ahmad Mamdouh